Skip to content

Commit 89bec7a

Browse files
dmsnelldmsnell
committed
KSES: Allow leading trailing double hyphen in data attributes
Expand allowable set of custom data attribute names to include those containing leading, trailing, and double `-` characters. Previously, WordPress was removing data attributes that are used in the Interactivity API. By allowing these additional custom data attributes, the related Interactivity API directives will preserve through `kses`. For example, the Interactivity API frequently relies on custom data attributes such as `data-wp-on--click="..."`. The change in [43981] would strip these out of the processed HTML, however. Developed in #6598 Discussed in https://core.trac.wordpress.org/ticket/61052 Props cbravobernal, dmsnell, gziolo, jonsurrell. Follow-up to [43981]. Fixes #61052. git-svn-id: https://develop.svn.wordpress.org/trunk@58294 602fd350-edb4-49c9-b593-d223f7449a82
1 parent 86bfd17 commit 89bec7a

2 files changed

Lines changed: 15 additions & 4 deletions

File tree

‎src/wp-includes/kses.php‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1263,11 +1263,10 @@ function wp_kses_attr_check( &$name, &$value, &$whole, $vless, $element, $allowe
12631263
* `data-*` (not to be mixed with the HTML 4.0 `data` attribute, see
12641264
* https://www.w3.org/TR/html40/struct/objects.html#adef-data).
12651265
*
1266-
* Note: the attribute name should only contain `A-Za-z0-9_-` chars,
1267-
* double hyphens `--` are not accepted by WordPress.
1266+
* Note: the attribute name should only contain `A-Za-z0-9_-` chars.
12681267
*/
12691268
if ( str_starts_with( $name_low, 'data-' ) && ! empty( $allowed_attr['data-*'] )
1270-
&& preg_match( '/^data(?:-[a-z0-9_]+)+$/', $name_low, $match )
1269+
&& preg_match( '/^data-[a-z0-9_-]+$/', $name_low, $match )
12711270
) {
12721271
/*
12731272
* Add the whole attribute name to the allowed attributes and set any restrictions

‎tests/phpunit/tests/kses.php‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1362,12 +1362,24 @@ public function data_safecss_filter_attr() {
13621362
* @ticket 33121
13631363
*/
13641364
public function test_wp_kses_attr_data_attribute_is_allowed() {
1365-
$test = '<div data-foo="foo" data-bar="bar" datainvalid="gone" data--invalid="gone" data-also-invalid-="gone" data-two-hyphens="remains">Pens and pencils</div>';
1365+
$test = '<div data-foo="foo" data-bar="bar" datainvalid="gone" data-two-hyphens="remains">Pens and pencils</div>';
13661366
$expected = '<div data-foo="foo" data-bar="bar" data-two-hyphens="remains">Pens and pencils</div>';
13671367

13681368
$this->assertSame( $expected, wp_kses_post( $test ) );
13691369
}
13701370

1371+
/**
1372+
* Data attributes with leading, trailing, and double "-" are globally accepted.
1373+
*
1374+
* @ticket 61052
1375+
*/
1376+
public function test_wp_kses_attr_data_attribute_hypens_allowed() {
1377+
$test = '<div data--leading="remains" data-trailing-="remains" data-middle--double="remains">Pens and pencils</div>';
1378+
$expected = '<div data--leading="remains" data-trailing-="remains" data-middle--double="remains">Pens and pencils</div>';
1379+
1380+
$this->assertSame( $expected, wp_kses_post( $test ) );
1381+
}
1382+
13711383
/**
13721384
* Ensure wildcard attributes block unprefixed wildcard uses.
13731385
*

0 commit comments

Comments
 (0)